horizontal-logic.blogspot.com

thinking-about-network-security.blogspot.com

Network Security: Charting Procmon network output with .NET 4.0 and Powershell

http://thinking-about-network-security.blogspot.com/2012/06/charting-procmon-network-output-with.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Thursday, June 21, 2012. Charting Procmon network output with .NET 4.0 and Powershell. Lots to work out in this post. Powershell v 3.0 CTP2 or Beta. Procmon is Mark Russinovich's flagship tool. For diagnosing Windows activity. It normally runs from the (admin) command prompt:. Procmon /noconnect /nofilter /minimized /quiet. Time of Day ...

thinking-about-network-security.blogspot.com

Network Security: Avoiding XPath: Part I

http://thinking-about-network-security.blogspot.com/2014/02/avoiding-xpath-part-i.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Saturday, February 8, 2014. Avoiding XPath: Part I. Typically a Security Event Log entry contains a Message entry that is resistant to anything but an XPath query:. TimeGenerated : 1/29/2014 1:32:01 PM. Message : The Windows Filtering Platform has permitted a bind to a local port. Filter Run-Time ID: 0. Layer Name: % 14608. Rv -ea 0 i;.

thinking-about-network-security.blogspot.com

Network Security: Avoiding XPath : Part II

http://thinking-about-network-security.blogspot.com/2014/02/avoiding-xpath-part-ii.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Saturday, February 8, 2014. Avoiding XPath : Part II. Auditpol /get /category:* findstr "Success and Failure". Security State Change Success and Failure. Logon Success and Failure. Logoff Success and Failure. Special Logon Success and Failure. Other Logon/Logoff Events Success and Failure. SAM Success and Failure. 01/29/2014 01:34 PM 61...

thinking-about-network-security.blogspot.com

Network Security: Less Thrashing; Better Queries (Part V)

http://thinking-about-network-security.blogspot.com/2012/09/less-thrashing-better-queries-part-v.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Tuesday, September 11, 2012. Less Thrashing; Better Queries (Part V). Updated: 7:01 AM 1/19/2014 -RMF. Using [System.Diagnostics.EventLog] for Powershell 3.0 Beta. Rv -ea 0 i;. Rv -ea 0 var. Var=@("a","b","c","d","e"); foreach ($i in $var) {rv -ea 0 $i}. Creating $a specific to the 'GetEventLogs()'. List the event logs. Returns select s...

thinking-about-network-security.blogspot.com

Network Security: Avoiding XPath : Part V

http://thinking-about-network-security.blogspot.com/2014/02/avoiding-xpath-part-v.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Thursday, February 27, 2014. Avoiding XPath : Part V. Under construction; updated 4/16/2014. Working with such large files in R has proved to be a real challenge for 4 GB RAM. I am studying various methods to overcome some of the challeges, but also am considering just working in Postgres or RPostgresSQL. Once EVTX logs are in CSV format.

thinking-about-network-security.blogspot.com

Network Security: Avoiding XPath: Part IV

http://thinking-about-network-security.blogspot.com/2014/02/avoiding-xpath-part-iv.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Thursday, February 27, 2014. Avoiding XPath: Part IV. Full source of my unpolished cruft is far below. If you are going to pull fields out of the Message in Windows Event log without Xpath or XML, how are you going to do it in Powershell 4.0? I will remind you of what the Message field looks like:. Filter Run-Time ID: 211332. E5156 = ($...

thinking-about-network-security.blogspot.com

Network Security: Get-Winevent Part III: Querying the Event Log for Logons (Part A)

http://thinking-about-network-security.blogspot.com/2011/06/get-winevent-part-iii-querying-event.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Tuesday, June 28, 2011. Get-Winevent Part III: Querying the Event Log for Logons (Part A). I was having some concern understanding a mysterious problem: my Windows 7 PC spontaneously un-sleeps itself and seemingly commences a log-on. I wanted to understand why this happened and if there was evidence of ex-filtration or malware. 6/28/201...

thinking-about-network-security.blogspot.com

Network Security: Thrashing memory with queries...(Part I)

http://thinking-about-network-security.blogspot.com/2012/08/trashing-memory-with-queries.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Wednesday, August 22, 2012. Thrashing memory with queries.(Part I). These are some event log search queries. They all trash my memory in any Powershell session. I have written them down for some reason. Probably so I can evolve more elegant solutions to such queries in the future. Start=(get-winevent -log security -max 1).TimeCreated.

thinking-about-network-security.blogspot.com

Network Security: Examining Thread States (Part I:Wait States)

http://thinking-about-network-security.blogspot.com/2012/12/examining-thread-states-part-i.html

This is the weblog for http:/ www.rmfnetworksecurity.com. See Also http:/ horizontal-logic.blogspot.com. For more Powershell code. AS of 2/27/2014 all Scripts are PS 4.0. Friday, December 14, 2012. Examining Thread States (Part I:Wait States). 11:13 AM 12/13/2012 Wait-Reasons known and unknown. Foreach ($id in ( Get-Process? Modules} ) {$id=($id.Threads where {$ .WaitReason -eq "Unknown"}).ID;$id }. 11:16 AM 12/13/2012 waiting state unknown. Rv -ea 0 id. Foreach ($i1 in ( Get-Process? Rv -ea 0 id. Thread...